Leech
Leech is a virus that runs on MS-DOS. It is a memory resident infector of .COM programs, including COMMAND.COM. Payload The first time a program infected with Leech is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available memory, as measured by the DOS CHKDSK program, will decrease by 2,080 bytes. Interrupt 21 will be hooked by the virus. Leech also makes use of interrupt 2F. Once Leech is memory resident, it will infect .COM programs over approximately 10K in size when they are executed. Infected programs will increase in size by 1,024 bytes, but the size increase will not be visible in the disk directory if Leech is memory resident. Programs which originally had a file time of 12:00a before infection will have their time disappear from the disk directory when viewed with Leech resident. Leech is located at the beginning of infected programs. Infected files will contain the following text string: The leech live ... April 1991 The Topler Leech is a stealth virus. If it is memory resident, anti-viral programs which are unaware of Leech will be unable to detect its presence on the system. Removal Delete the infected files. Variants Leech.1008 Leech.1008 is a 1,008 byte variant of Leech. Its size in memory is approximately 2,048 bytes, hooking interrupt 21. Once resident, it infects .COM files when they are executed, opened, or copied. Infected files will have a file length increase of 1,008 bytes, with the virus being located in the beginning of the file. The program's date and time in the DOS disk directory listing will appear to be unaltered, though the seconds field will have been set to "60". The following text strings are visible within the viral code: Super, Super! March 1993, Tazta Leech.1025 Leech.1025 or Insane.1025 is a 1,025 byte variant of Leech. It is also a variant of Riot. Its size in memory is approximately 4.1 kilobytes, hooking interrupt 21. Once resident, it infects .COM files when they are executed. Leech.1025 infected files will have a file length increase of 1,025 bytes, though the file length increase will be hidden when the virus is memory resident. The virus will be located at the beginning of the file. The file's date and time in the DOS disk directory listing will appear to be unaltered, though the seconds field will have been set to "60". The following text string is visible within the viral code: Insane Reality.. The Unforgiven / IR.. The DOS CHKDSK program will return file allocation errors on all infected files when the virus is memory resident. Leech.1026 Leech.1026 or Insane.1026 is a 1,026 byte variant of Leech. Just like Leech.1025, it is also a variant of Riot. Its size in memory is approximately 4.1 kilobytes, hooking interrupt 21. Once resident, it infects .COM files when they are executed. Leech.1026 infected files will have a file length increase of 1,026 bytes, though the file length increase will be hidden when the virus is memory resident. The virus will be located at the beginning of the file. The file's date and time in the DOS disk directory listing will appear to be unaltered, though the seconds field will have been set to "60". The following text string is visible within the viral code: Insane Reality.. The Unforgiven / IR.. The DOS CHKDSK program will return file allocation errors on all infected files when the virus is memory resident. Leech2 Functionally equivalent to the original virus, Leech2 has seven bytes which differ. Leech2 will also infect programs when they are opened for any reason. Category:DOS virus Category:DOS Category:Virus Category:Assembly Category:TSR